CVE Vulnerability Catalog

An input validation flaw was found in the FTP GVfs backend. A remote attacker can supply crafted file paths containing CRLF sequences to terminate intended FTP commands and inject arbitrary FTP commands.

A flaw was found in the FTP GVfs backend where a malicious FTP server can provide an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the malicious server to probe for open ports accessible from the client's network.

A path traversal vulnerability was found in VideoLAN VLC for Android prior to version 3.7.0 in the Remote Access Server. The vulnerability exists in the authenticated endpoint GET /download, where the file query parameter is concatenated into a filesystem path without canonicalization or directory containment checks. This allows an authenticated attacker with network access to the Remote Access Server to request files outside the intended directory.

An HTTP Host header attack vulnerability in PcVue WebClient and WebScheduler web apps (versions 15.0.0 through 16.3.3) allows a remote attacker to inject harmful payloads that manipulate server-side behavior. The issue affects specific endpoints: /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback, and /Authentication/Logout.

The Secure and SameSite attributes are missing in cookies used by the GraphicalData web services and WebClient web app of PcVue versions 12.0.0 through 16.3.3. This allows session hijacking and CSRF attacks.

The web server does not properly set some HTTP security headers in responses sent to client applications. This can weaken protection against attacks such as XSS, clickjacking, and other threats due to missing security headers.

An XSS vulnerability in PcVue OAuth services (versions 12.0.0–16.3.3) allows a remote attacker to inject malicious code into the OAuth server error page. The attack requires tricking an authenticated user into loading content from an external site after a failed login.

A vulnerability in PcVue (versions 12.0.0 through 16.3.3) causes HTTP headers to be added by the default IIS and ASP.NET configuration, which are not removed during the deployment of web services for WebVue, WebScheduler, TouchVue, and SnapVue features. This unnecessarily exposes sensitive server configuration information.

Missing origin validation in WebSockets in PcVue versions 12.0.0 through 16.3.3 (WebVue, WebScheduler, TouchVue, SnapVue) allows a remote attacker to lure an authenticated user to a malicious website. Only endpoints GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect are affected.

An XSS vulnerability in the Angular i18n pipeline allows arbitrary JavaScript execution if an attacker compromises the translation file. Affects versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 due to unsanitized HTML in ICU messages.

FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to 2.11.8 and on the 3.x branch prior to 3.23.0 have an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel that allows a malicious RDP server to read uninitialized heap memory by sending a crafted WIRE_TO_SURFACE_2 PDU with a bitmapDataLength value larger than the actual data in the packet. This can lead to information disclosure or client crashes when a user connects to a malicious server. Versions 2.11.8 and 3.23.0 fix the issue.

OpenEMR is a free and open source electronic health records application. Prior to version 8.0.0, the document controller's patient_picture context serves the patient's photo by document ID or patient ID without verifying that the current user is authorized to access that patient. An authenticated user with document ACL can supply another patient's ID and retrieve their photo.

The auth_jwt module in OpenSIPS versions 3.1 before 3.6.4 contains a SQL injection vulnerability in the jwt_db_authorize() function. An attacker can send a crafted JWT with a malicious tag claim that is directly incorporated into a SQL query without sanitization, allowing bypass of JWT authentication and impersonation of arbitrary identities.

A flaw in the udisks daemon allows unprivileged users to back up LUKS encryption headers without authorization. The privileged D-Bus method that exports encryption metadata does not perform a policy check.

The RepoCard component in Repostat before version 1.0.1 is vulnerable to reflected XSS because it uses dangerouslySetInnerHTML to render the repository name without sanitization. If a developer passes unvalidated user input into the repo prop, an attacker can execute arbitrary JavaScript in the user's browser.

A vulnerability in Parse Dashboard versions 7.3.0-alpha.42 through 9.0.0-alpha.7 causes the `ConfigKeyCache` to use the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only user can receive the cached full master key, or a regular user can receive the cached read-only master key.

Parse Dashboard versions 7.3.0-alpha.42 through 9.0.0-alpha.7 lack CSRF protection for the AI Agent endpoint (`POST /apps/:appId/agent`). An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submits requests to this endpoint using the victim's session.

GetSimpleCMS Community Edition prior to version 3.3.22 contains a stored XSS vulnerability in the Theme to Components functionality in components.php. The "slug" field of a component is stored without proper output encoding, allowing arbitrary JavaScript execution in the admin interface.